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FOREWARD 


This report was prepared by Rockwell International, Rocketdyne Division, under 
Contract NAS8-40000 to satisfy the Fast Shutdown Sequence Assessment portion 
of WBS 4.4.10. 


ABSTRACT 


This study develops the fastest practical shutdown sequence for the Technology 
Test Bed Engine. A sequence is defined and key issues are addressed. The 
conclusion of the study is that a fastest shutdown sequence within the 
existing SSME design capability is practical and can cut oxidizer consumption 
by 50%. However, the revised sequence would not have prevented any of the 
prior experienced SSME incidents and would introduce development risk to the 


program. 
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INTRODUCTION 


The purpose of this study was to develop the fastest practical engine shutdown 
sequence for use with redline initiated cutoffs. The specified goal was to 
reduce the amount of oxygen available to an engine during an incident. 
Practicality of a sequence was determined by existing system limitations, most 
confining of which was the maximum valve closing rate of 200%/second. 

Areas of concern were identified and significant items were addressed. Also, 
included are implementation issues and recommendations concerning future 
efforts. 


RESULTS SUMMARY 


Prior to looking at the sequencing question, it was necessary to adjust the 
digital transient model system resistances to reflect changes in the hardware 
made to accommodate additional Technology Test Bed engine (TTB) 
instrumentation and to match steady state operating levels defined in the 
Steady State Power Balance for the TTB. 

The shutdown sequence developed in the study is depicted at RPL and compared 
to the Phase II sequence at RPL, as shown in Figures 1 through 10. In all the 
plots presented in this report, the cutoff signal is at 31 seconds. The time 
31 seconds is arbitrary and has no special significance. The changes in valve 
sequencing and rates are depicted in Figure 1 and can be compared to the 
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RESULTS SUMMARY (CONTINUED) 

nominal sequence in Figure 2. Note that in the fast shutdown sequence, the 
oxidizer preburner valve and main oxidizer valves close at the maximum rate, 
whereas the fuel preburner valve closes at a slower than maximum rate. This 
FPOV sequencing was found to be necessary to provide a smooth transient and 
will be discussed in subsequent paragraphs . 

The fast shutdown sequence developed in this study results in a decay of main 
combustion chamber pressure to 102 in about 0.5 second compared to about 1.5 
seconds for the Phase II nominal shutdown as shown in Figure 3. The 
accumulated oxidizer flow during the shutdown transient is approximately one 
half, 352 lbs. vs. 716 lbs., and is depicted in Figure 11. The comparative 
oxidizer total flowrates are shown in Figure 12. The total oxidizer flow is 
defined as the sum of the oxidizer flows to the fuel and oxidizer preburners 
and the flow through the main oxidizer valve. 

The study included simulation of engine shutdown at full power level (FPL), 
rated power level (RPL), and minimum power level (MPL). These transients are 
presented in Figures 13 through 23. In the process of assessing different 
power levels, it was found that the MPL was the most stability sensitive, and 
required several iterations on the fuel preburner valve closing rate. If the 
fuel preburner oxidizer valve is closed at the maximum rate, 200 
percent/second, as shown in Figure 24, the decay is oscillatory, as shown in 
Figure 25. Slowing the valve closing rate to 50 percent/second resulted in a 
smooth, non-osci llatory shutdown transient. 

- 2 - 
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RESULTS SUMMARY ( CONTINUED) 

The main combustion chamber and high pressure turbine temperatures (Figures 4, 
5, 6, 17, 18, and 19) show good behavior decaying smoothly and rapidly. The 
high pressure pump speeds (Figures 7, 8, 20 and 21) decay smoothly except for 
the effect of preburner shutdown purges which cause temporary speed 
increases. The pressure surges in the low pressure oxidizer pump inlet and 
discharge ducts (Figures 9, 10, 22, and 23) are below 200 psia and 600 psia, 
respectively. The surge pressures are higher than in a nominal shutdown 
sequence, but well within structural limits. The discharge duct pressure 
limit with the operating loads in effect is 695 psia. 

The effect of an early purge is seen in Figures 7 and 8. In this case, the 
preburner purges are activated at the cutoff signal, but do not become 
effective until the system pressures drop below the purge supply pressure of 
750 psia. For the nominal shutdown, the purges are set to go on at 1.8 
seconds after the cutoff signal. For the fast shutdown, the purges will be 
set at 0.0 to 0.8 seconds because it results in a faster decay in high 
pressure pump speeds. 

2 1 

An analysis of the High Pressure Fuel Pump (HPFP) head (AP/pN ) and 
flow (W/pN) 1 parameters depicted in Figure 28 shows that the points lie on 
the negative slope of the design curve except at the end of the shutdown 
transient when flows drop below the 10 percent level. This characteri Stic is 
required to maintain stable pump operation and to preclude premature pump 
stall. All pumps show stable operation with the fast shutdown. 

1 ) AP = pump pressure rise 

p =» fuel density 
N - pump speed 

W =» pump weight flowrate 


- 3 - 
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VALVE SEQUENCING 

The valve shutdown sequence developed in this study is depicted in Figure 1. 
The OPB oxidizer valve closes at a rate of 200 percent/second. The FPB 
oxidizer valve closes at a rate of 50 percent/second. The MOV also closes at 
200 percent/second with a first order lag built into the control loop. The 
MFV begins to close at 31.5 seconds at a rate of 75 percent per second to 75 
percent open, held at that position for about 2.25 seconds and then closed at 
a rate of 100 percent per second. The CCV closes at about 0.7 seconds after 
the MFV to about 62 percent open and then closes again as the MFV closes and 
at a rate of 200 percent per second. 

It was found in earlier runs that when the FPB oxidizer valve was closed at 
the maximum rate (200 percent/second), the shutdown transient was oscillatory, 
as shown in Figure 25. It was found that the main combustion chamber 
flowrates and instantaneous accumulated gas weights were driving this 
oscillation. With the slower closing rate (50 percent per second), the fuel 

flowrate remains higher relative to the oxidizer flowrate resulting in a 
smooth decay of pressures and flows. Note that once this developed, the 

closing to zero position of the MFV and CCV was begun about 1.25 seconds 
sooner than that shown in Figure 2, the current shutdown sequence. 

Shutdowns with the fast shutdown sequence are environmentally benign at all 
three power levels examined, as indicated in Figures 13 through 23. Note that 
at different power levels, the preburner valves and CCV begin the shutdown 
from different initial positions. 


- 4 - 
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VALVE SEQUENCING ( CONTINUED) 

The changes in sequencing are more conspicuous when the sequencing is compared 
to that of the Phase II model, as shown in Figure 2. The net result is 
illustrated in the comparison of chamber pressures in Figure 3 where the TTB 
shutdown gets to 10 percent in about 0.5 second compared to about 1.5 
seconds. The objective of the study was to reduce accumulated oxidizer flow 
and this is shown in Figure 11 indicating a 50 percent reduction from the 
Phase II shutdown sequence. 

The resulting main chamber and high pressure turbine temperatures all remain 
below that of the Phase II transients, as shown in Figures 4, 5, and 6. The 
high pressure pump speeds appear well behaved, as shown in Figures 7 and 8, 
decreasing smoothly to below the 10,000 rpm level. The rise in speed just 
after the initial drop results from the onset of purges. 

It was observed that the oxidizer preburner chamber pressure decay to 750 psia 
(the purge pressure level) follows Oxidizer Preburner Oxidizer Valve (0P0V) 
closure by about 0.9 second for shutdowns from FPL and RPL and by about 0.4 
second for MPL. Test experience indicates that this condition provides the 
potential for burning of 0P0V ball seal. An attempt was made to avoid this 
condition by delaying the closing of the 0P0V, as shown in Figure 26. This, 
however, resulted in a surge in High Pressure Oxidizer Pump (HP0P) discharge 
pressure, as shown in Figure 27 and the preburner pump discharge pressure as 
well. It was thought that the sequence should remain as it was and that 


- 5 - 
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VALVE SEQUENCING ( CONTINUED) 

following any emergency shutdown, the OPOV ball seal would be replaced. This 
procedure is presently in practice with the SSME for shutdowns between 1.5 and 
5.0 seconds. 


STEADY STATE BALANCE AND RESISTANCES 


The steady state balance for the Phase II TTB engine was used to model fluid 
resistances between points on the System Dynamics Model schematic where 
changes in the hardware had been made. Resistances were computed using the 
pressures, flow rates, and temperatures. These were then input into the - 
system dynamic computer model for this study. 


CONCLUSIONS ANO RECOMMENDATIONS 


The results of this study indicate that a fast shutdown is possible. Decay of 
main chamber pressure to 10 percent RPL can be reduced from 1.5 seconds to 0.5 
seconds. Oxygen consumption during the shutdown transient can be cut in 
half. This sequence represents the fastest practical shutdown since it 
utilizes the maximum closing rate of both the OPOV and MOV. 


- 6 - 
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CONCLUSIONS AND RECOMMENDATIONS ( CONTINUED) 

Several adverse Effects to engine hardware have been identified. The OPOV 
ball seal requires inspection for burning after each fast shutdown. Also, a 
reduction in turbine component life will be experienced due to accelerated 
quenching by the shutdown. The magnitude of the life reduction was not 
quantified as part of this study. An additional concern exists with preburner 
pops, which may increase due to the rapidly changing environments within the 
preburners . 

Selection of redlines initiating the fast shutdown was limited to the five 
existing controller redlines and the facility initiated cutoff. Only the 
HPOTP secondary seal cavity pressure and intermediate seat purge pressure 
redlines potentially benefited from the fast shutdown in all cases. Any 
oxidizer reduction to these failure modes was beneficial; however, even the 
fast shutdown is much too slow to adequately respond to these failure modes. 
The other four redlines could all be caused by failures which may be 
exacerbated by the fast shutdown. 


- 7 - 
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CONCLUSIONS AND RECOMMENDATIONS (CONTINUED) 

The final measurement of the effectiveness of the fast shutdown was to examine 
its potential benefit to the 26 major failures experienced in the SSME program 
to date. The failures examined are listed in Table 1. The speed and nature 
of each failure was examined in this review. In each case, the significant 
engine damage occurred prior to the cutoff signal. It was inconclusive 
whether the fast shutdown would have prevented further hardware damage by 
reducing engine oxidizer flow, or caused additional damage by increasing the 
magnitude of pressure surges. Damage done to the test facility would not have 
been significantly reduced, due to the large volume of oxygen available 
downstream of the facility prevalves. Facility repairs have been relatively 
minor in nature and have not been the pacing item in the return to testing. 

The overall evidence produced in this study indicates even the fastest TTB 
engine shutdown sequence may not benefit to the program. The engine's control 
system response capability is the limiting factor and increases in surge 
pressures would prevent significantly faster shutdowns. 


- 8 - 
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TABLE I 



SSME FAILURE SUMMARY 


ENGINE 

DATE 

FAILURE MODE 

TYPE CUTOFF 

DAM- 

AGE 

CONT. 

FLT 

SHUT- 

DOWN 

INFLIGHT 
DATA DETECT 

0003 

3 24-77 
(901-110) 

HPOTP PRIMARY LOX 
SEAL RUB - IGNITION 

OBSERVER - FIRE 

N 

1 

Y 

0004 

8-27-77 

(901-133) 

FUEL PREBURNER 
WALL BURNTHROUGH 

OBSERVER - FIRE 

N 

B 

N 

0004 

9877 

(901-136) 

HPOTP BEARING 
FAILURE 

OBSERVER - FIRE 

N 

B 

Y 

0103 

12-1-77 

(901-147) 

HPFTP TURBINE 
BLADE FAILURE 

HPOTP VIBRATION 

B 

N 

Y 

0002 

3-31-78 

(901-173) 

MAIN INJECTOR LOX 
POST FATIGUE CRACK 

HPFTP TURBINE TEMPERATURE 

fl 

B 

Y 

0101 

6-1078 

(902-112) 

ENGINE FUEL SUPPLY 
BLOCKAGE - SOLID N 2 

HPFTP SPEED 

B 

B 

Y 

0005 

85-78 

(901-185) 

MAIN INJECTOR LOX 
POST FATIGUE CRACK 

HPFTP VIBRATION 
(UNRELATED TO FAILURE) 

fl 

fl 

Y 

0101 

7-18-78 

(902-120) 

HPOTP EXPERIMENTAL 
INST. DEVICE RUB- 
IGNITION 

HPOTP VIBRATION 

B 

1 

Y 


^1^ Rockwell 

International 

ftockatdyn* Division 
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TABLE I (CONTi .uED) 


SSME FAILURE SUMMARY 



ENGINE 

DATE 

FAILURE MODE 

TYPE CUTOFF 

DAM 

AGE 

CONT. 

FLT 

SHUT 

DOWN 

IN-FLIGHT 
DATA DETECT 

0006 

10 3 78 
(902-132) 

ABNORMAL START - 
MOV CLOCKING 

LOW CHAMBER PRESSURE 

fl 

fl 

Y 

0007 

12 6-78 
(901-222) 

HEAT EXCHANGER 
COIL LEAK 

HEAT EXCHANGER OUTLET 
PRESSURE 

N 

N 

Y 

2001 

12-27-78 
(901 225) 

MAIN OXID. VALVE 
SLEEVE IGNITION 

HPFTP TURBINE TEMPERATURE 

N 

N 

Y 

0201 

5 1479 
(750 041) 

STEERHORN RUPTURE 

FAILURE OCCURRED AFTER 
CUTOFF 

Y 

Y 

Y 

2002 

7-2-79 

(SF6-01) 

MAIN FUEL VALVE 
HOUSING FAILURE 

HPFTP TURBINE TEMPERATURE 

N 

Y 

Y 

2002 

11-4 79 
(SF6-03) 

STEERHORN RUPTURE 

FAILURE OCCURRED AFTER 
CUTOFF 

Y 

Y 

Y 


7 12 80 
(SF10-01) 

FUEL PREBURNER WALL 
BURNTHROUGH 

OBSERVER - FIRE 

N 

N 

Y 

2004 

7-23 80 
(902 198) 

MAIN INJECTOR LOX 
POST FATIGUE CRACK 

HPOTP TURBINE TEMPERATURE 

Y 

Y 

Y 

0010 

73080 

(901-284) 

MAIN Pc SENSING 
LEE JET FAILURE 

HPOTP VIBRATION 

N 

Y 

Y 


Rockwell 

International 

Rocketdyne Divition 
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TABLE I (CONTINUED) 



SSME FAILURE SUMMARY 


ENGINE 

DATE 

FAILURE MODE 

TYPE CUTOFF 

DAM- 

AGE 

CONT. 

FLT 

SHUT- 

DOWN 

in-flight 

DATA 

DETECT 

2108 

7-1581 
(901 331) 

MAIN INJECTOR LOX 
POST FATIGUE CRACK 

HPOTP TURBINE TEMPERATURE 

Y 

Y 

Y 

0110 

9-2-81 

(750-148) 

MAIN INJECTOR LOX * 
POST FATIGUE CRACK 

HPOTP TURBINE TEMPERATURE 

Y 

Y 

Y 

0204 

921-81 

(902-249) 

HPFTP TURBINE 
BLADE FAILURE 

HPFTP VIBRATION 

N 

N 

Y 

0110F 

2 12 82 
(750 160) 

FUEL PREBURNER 
FUEL FLOW 
BLOCKAGE(ICE) 

HPFTP TURBINE TEMPERATURE 

N 

Y 

Y 

2013 

4-7-82 

(901-364) 

HPFTP TURBINE 
RETAINER NUT LEAK 

HPOTP VIBRATION 

N 

N 

Y 

2208 

8 27-82 
(750-175) 

HPOTP DISCHARGE 
DUCT RUPTURE 

HPOTP VIBRATION 

N 

N 

Y 

0108 

2-14 84 
(901-436) 

TURBOPUMP COOLANT 
LINER BULGE 

HPFTP VIBRATION 

N 

Y 

Y 

0207 

2-4-85 

(901-468) 

FUEL PREBURNER 
INST. PORT CRACK 

OBSERVER - FIRE 

N 

N 

N 

2308 

3-27-85 

(750-259) 

MAIN COMBUSTION 
CHAMBER OUTLET 
NECK RUPTURE 

HPFTP VIBRATION 

N 

N 

Y 


^1^ Rockwell 

International 

Rockeldyne Division 
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